<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Oh great, I were not aware there is something similar. I would
like to avoid the need for a restart. dnsmasq has similar special
knob, but I were not aware unbound has something like it too.<br>
</p>
<p>I have tested it even on older unbound, it is possible to
manipulate this properly via unbound-control set_option
"val-override-date: -1"</p>
<p>And indeed, if I set the clock to wrong value and flush org zone,
it fails until I call above unbound-control command. It is a bit
concerning in that case it still has ad bit, even though it were
not full validated. And I expect no other indication to client
hints not full validation were done. But yes, starting with
val-override-date: -1 in configuration and setting
"val-override-date: 0" with cache flush once time is set initially
after boot would be the best solution I can find.</p>
<p>The cache flush could be avoided if it were possible to flush
just records, which do not pass only time checks. Since we have
already done crypto validation, we have already the most CPU
intensive work done. Better to not waste it by full cache flush
again.<br>
</p>
<div class="moz-cite-prefix">On 17. 04. 23 16:45, Daisuke HIGASHI
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAO-L_V9V9SA1UgTU_dE9Rpnmv=s8pv3PwAmCmqHxSA8W1AxWcQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="auto"><span style="border-color:rgb(0,0,0)"><br>
</span></div>
<div dir="auto"><span style="border-color:rgb(0,0,0)"> Run
Unbound</span> in "val-override-date: -1" mode at very short
term after boot, and once your machine gets good datetime[1],
restart Unbound in normal mode. <br>
</div>
<div dir="auto"><br>
</div>
<div dir="auto"> In this mode, Unbound performs DNSSEC validation
without RRSIG expiration check. The only risk you must take here
is the possibility of accepting expired signatures.</div>
<div dir="auto"><br>
</div>
<div dir="auto">[1] The next problem is to get datetime by secure
method. Your company should run DNS server publishing datetime
in signed zone like:</div>
<div dir="auto"> <a href="http://time.redhat.com"
moz-do-not-send="true">time.redhat.com</a>. IN TXT
"1687842121"</div>
</blockquote>
<p>No, I really do not think we should make methods alternative to
NTP in the DNS itself. Besides fetching such name still requires
valid time to check com. zone (redhat.com is not signed at the
moment).</p>
<pre class="moz-signature" cols="72">--
Petr Menšík
Software Engineer, RHEL
Red Hat, <a class="moz-txt-link-freetext" href="http://www.redhat.com/">http://www.redhat.com/</a>
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB</pre>
</body>
</html>